An improper access control flaw in MyTube allows an attacker with low‑privilege credentials to invoke the "/api/settings/import-database" endpoint via POST requests. The endpoint accepts an uploaded SQLite database and replaces the existing application database without proper authorization checks. Because the database contains all application data and configuration, the attacker effectively gains complete control of the application, including modifying settings, uploading content, and possibly executing arbitrary code. The weakness is a classic example of forbidden resource injection and privilege escalation (CWE‑285 and CWE‑639).

The vulnerability affects the MyTube application distributed by franklioxygen. Any deployment running a version prior to 1.8.69 is vulnerable. Version 1.8.69 and later contain a fix that enforces proper role‑based access control for the import endpoint and related POST routes.

The CVSS score of 7.4 indicates high severity, reflecting the possibility of full compromise. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, implying it may be an emerging threat. The attack requires only authenticated access to a low‑privilege account and an HTTP POST to the vulnerable endpoint, making it relatively easy to exploit in a compromised or open environment. Immediate remediation is recommended to prevent potential data loss or takeover.